Privacy Policy

This Privacy Policy applies to personal information we process as a controller (information about you as a visitor or customer) and describes our role as a processor of Customer Data you submit through the Service (for example, your chart of accounts).

The Service is offered from the United States and is intended for business users in the United States. We do not target the Service to individuals in the European Economic Area, United Kingdom, or Switzerland; however, we have written this policy to be compatible with the GDPR, UK GDPR, and California privacy laws where they apply.

Data controller / business: Arrow CFO LLC, reachable by email at legal@chartofaccounts.ai.

We collect the following categories of information.

(a) Account & profile data

• Name, work email, password hash, role, phone number, time zone, and a profile picture if you add one
• Company name, industry, size, country, billing address, phone number, website, and tax identification number
• Authentication identifiers from Supabase Auth

(b) Customer Data (financial data you submit)

• Chart of accounts (account names, types, sub-types, balances, hierarchy) imported from QuickBooks Online, uploaded as CSV/Excel, or entered manually
• The business profile you fill in: revenue range, tax filing type, accounting method, compliance requirements, workforce type, number of locations, whether you hold inventory, fiscal year end, and how you describe your financial priorities
• Industry templates you generate from your data and saved optimization results

We do not collect transactional ledger entries, customer or vendor lists, banking credentials, payroll records, tax filings, or anything from QuickBooks Online beyond your chart of accounts and your company information. See Section 7 for what the QuickBooks connection reads.

(c) Billing data

• Stripe customer ID, subscription ID, plan, status, last-four digits of payment card, billing address, invoices, credit ledger
• We do not see or store full payment card numbers — Stripe handles all card data as a PCI Level 1 processor.

(d) Usage & device data

• IP address, browser, operating system, device type
• Pages visited, features used, AI prompts you invoke, timing and outcome of analyses and optimizations
• Diagnostic logs and error reports

(e) Communications

• Support tickets, email correspondence, feedback you submit

(f) Cookies & similar technologies

See our Cookie Policy for the full list of cookies, the local-storage keys we write (including a durable visitor id), their purpose, and how to control them.

(g) Early-access requests

• Name, work email, company, and role, if you ask for early access without creating an account
• Where the request came from: the campaign source, medium, and campaign name in the link you followed

We use information to:

• Provide, operate, secure, and improve the Service, including running AI analysis and optimization on your chart of accounts
• Authenticate you, prevent fraud, and enforce our Acceptable Use Policy
• Process payments and manage subscriptions and credits
• Send transactional messages (receipts, security alerts, product changes that affect you)
• Provide customer support and respond to your requests
• Analyze aggregate, de-identified usage trends to improve the Service
• Comply with legal obligations, respond to lawful requests, and protect our rights and the rights of others

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use your Customer Data to train AI models.

If GDPR or UK GDPR applies to you, we rely on these legal bases:

• Contract — to provide the Service you have signed up for.
• Legitimate interests — to secure the Service, prevent abuse, and improve our product (balanced against your rights).
• Consent — to measure your visits to our website. We store a visitor id and record page views only after you click Accept on the cookie banner, and you can withdraw that at any time with “Cookie settings” in the site footer. Every cookie we set is strictly necessary to sign you in or take a payment, so cookies themselves are not set on consent. If you signed up with our sign-up form, your sign-in record notes when you accepted our Terms of Service and this Privacy Policy, and which versions. Creating an account with Google, from our sign-up page or our sign-in page, records the same note. An account created with Google before we began recording it has no such note until you next continue with Google, and the note then shows that later date. When you delete your account, we keep a copy of that note as it stands then, as evidence of our agreement with you, not as consent to process your data. Section 8 says how long we keep it. If we introduce other processing that needs consent, we will ask before it starts and this list will say so.
• Legal obligation — to comply with tax, accounting, anti-fraud, and other legal requirements.

We share information only with the following categories of recipients:

• Subprocessors — vendors who process data on our behalf under written contracts (Stripe, Supabase, Vercel, Anthropic, Intuit, and others). See our Subprocessor List for the current roster.
• Cloudflare, for the “Verify you are human” box — our sign-up, sign-in and password reset pages show a box from Cloudflare, Inc. (Cloudflare Turnstile), and no other page does. When one of those pages opens, your browser sends Cloudflare your IP address and signals the box reads from your browser and device, such as the browser’s User-Agent and the fingerprint of its secure connection. We use the box to tell a person from an automated program, so that we can stop fake sign-ups and password guessing. When you submit the form, Supabase, our sign-in provider, sends Cloudflare the box’s single-use token and your IP address to check it. Cloudflare also uses these signals to improve its bot detection, as its own data controller under its Turnstile Privacy Addendum. The box runs only while we have it switched on.
• Your authorized integrations — when you connect QuickBooks Online, we exchange data with Intuit as directed by you.
• Professional advisors — accountants, auditors, and lawyers under confidentiality.
• Legal & safety — to comply with law, respond to lawful requests, enforce our Terms, or protect rights, property, or safety.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy or written notice to you.

We do not disclose Customer Data to government authorities except where legally required and only to the minimum extent necessary.

The Service uses Anthropic’s API to analyze your chart of accounts and produce suggestions. When you initiate an AI workflow:

• We send your account names, account numbers, account types, the parent-child hierarchy, our own internal identifier for each account, and your account balances. For some workflows we also send the business profile described in Section 2(b). We do not send transactions, customer or vendor lists, banking credentials, or payroll data.
• We use Anthropic’s commercial API. Under Anthropic’s Commercial Terms, your data is not used to train Anthropic’s models and is not retained beyond the period required to operate the API.
• We mark the instruction text of most of our requests as cacheable, which lets Anthropic hold it for a short period so that repeated steps cost less. This is not a switch we turn on for particular customers: it is how the requests are built. Whether Anthropic caches a given request is its decision — short instructions are below its minimum and are not cached at all. Your chart of accounts normally travels outside the cacheable part. One analysis workflow can be configured to put the chart of accounts in it as well, and that configuration is off by default. Anything cached is covered by the same Anthropic Commercial Terms as the request it came from.
• We do not use your Customer Data to train our own models. If we ever introduce optional training, it will require your separate, affirmative opt-in.
• Anthropic is the only AI provider that receives your data through any part of the product you can use. Our codebase also contains an internal testing route that can call OpenAI. It is not linked from anywhere in the product, and the request middleware returns 404 for it in any production build, so it is not reachable by a customer. We describe it rather than claim it does not exist, because it does.
• AI outputs are proposals only and must be reviewed by a qualified accounting professional before applying any change to your live books. See Section 3 of the Terms of Service.

If you connect QuickBooks Online, we use the Intuit OAuth 2.0 flow and request one scope,com.intuit.quickbooks.accounting, which is Intuit’s standard accounting scope. We use it only to read your chart of accounts and company information. Specifically:

• We read account names, types, sub-types, classifications, and balances.
• We never write to, modify, or delete data in your QuickBooks Online company.
• You may revoke our access at any time from within the Service or directly in your Intuit account settings.
• When you disconnect, we delete the stored OAuth refresh and access tokens immediately.

We are not affiliated with, endorsed by, or partnered with Intuit Inc.

We keep information for as long as your account exists, and we keep it after your account closes. Email support@chartofaccounts.ai to ask us to delete your information, and we will delete it, except where we are required to keep it. The bullets below say what we hold and why.

• Account & profile data — kept for the life of your account. When you delete your account, we remove your name, email address, username, phone number, profile picture and password straight away, and we delete your sign-in. The account record itself stays, with those details removed, because your charts and billing records are attached to it. You can sign up again with the same email address; that starts a new account, and nothing from the deleted one carries over.
• Customer Data — retained after you delete your account. Deleting your account anonymizes your name and email. If you are the last active user in your company, we also anonymize the company’s name, address, phone number and tax ID, delete the stored QuickBooks tokens, ask Intuit to revoke the connection, and cancel your subscription so that it does not renew. We do not automatically refund the month you have already paid for (see the Refund Policy). Your charts, account balances and billing history are retained, no longer linked to an account you can sign in to. Email support@chartofaccounts.ai to request full deletion. Archiving a chart hides it from your workspace. The chart and its account balances are retained until you ask us to remove them.
• Closure record — when you delete your account, we first write one closure record. It holds the copy of the note of your acceptance of our Terms of Service and this Privacy Policy described in Section 4, if your sign-in record has one; the date you signed up; if you were the last person using your company, the ID Stripe gives each of its subscriptions, what happened to each one when you deleted your account (for example, set to end with its paid term, or cancelled), and the dates each one started and ends; the date you deleted your account; and the customer ID Stripe keeps for your company’s billing, if your company has one. At Stripe, that ID may belong to a colleague who pays for your company rather than to you. If you were the last person using your company and Intuit did not confirm that it disconnected every QuickBooks connection we asked it to disconnect, the closure record also notes how many connections your company had, how many of them Intuit confirmed, and when we asked. That tells us a connection may still be open at Intuit. The closure record holds no name and no email address. We keep it because tax records and payment disputes can require us to show that you were a customer and what you agreed to. We delete it seven years after the date you deleted your account.
• Billing records — kept. US tax and accounting recordkeeping rules require invoices and payment records to be available for seven years, which is why we keep them. Apart from the closure record, we do not delete them on a schedule. Stripe, our payment processor, keeps your email address, invoices and payment history on its own customer record. Deleting your account here does not delete that record at Stripe; Stripe’s own privacy policy covers how long it keeps it.
• Logs & diagnostic data — runtime server logs sit with our hosting provider and expire on their schedule, which we do not set or control. The diagnostic records we store ourselves — error reports, activity records and usage records — do not expire on any schedule. The closure record above is the one exception.
• AI prompts & outputs — stored with the chart they belong to. Archiving a chart does not remove them. Deleting an analysis in the app removes the step records saved under it, prompts and responses included; separate per-attempt diagnostic copies are kept, and those are retained until you ask us to remove them.
• Credit balances — wallet credits do not expire. We do not forfeit credits for inactivity and we do not close accounts for inactivity. See the Refund Policy.

When required by law, we may retain information longer (e.g., for tax, audit, or litigation hold purposes).

We use administrative, technical, and physical safeguards designed to protect personal information and Customer Data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access control and least-privilege provisioning
• Hosted infrastructure with SOC 2 Type II certified providers (Vercel, Supabase, Stripe, Anthropic, Intuit)
• Routine vulnerability scanning, dependency monitoring, and code review

We have not completed a SOC 2 audit. No system is perfectly secure; if we become aware of a security incident affecting your information, we will notify you and any regulators in accordance with applicable law.

All Service infrastructure is located in the United States. Information you submit will be processed in the US. If you access the Service from outside the US, you understand that your data will be transferred to and processed in the US.

One exception: the “Verify you are human” box described in Section 5 is served from Cloudflare’s global network, so your browser reaches the Cloudflare data center nearest to you, which may be outside the United States. Cloudflare says it primarily stores information in the United States and the European Economic Area.

Where required, we rely on the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and other approved transfer mechanisms with our subprocessors. A copy of the SCCs is available on request via legal@chartofaccounts.ai.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete personal information (“right to be forgotten”)
• Restrict or object to certain processing
• Port your data in a machine-readable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with your supervisory authority (e.g., your EU/UK data protection authority or your state Attorney General)

To exercise these rights, email legal@chartofaccounts.ai. We respond within 30 days (45 for CCPA, extendable once where permitted). We may need to verify your identity before fulfilling your request. We will not discriminate against you for exercising your rights.

California (CCPA/CPRA). In the prior 12 months, we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet activity, professional/employment information, inferences) for the business purposes described in Section 3, and shared them with the categories of recipients in Section 5. We have not sold personal information and have not shared personal information for cross-context behavioral advertising. We do not knowingly collect personal information from minors under 16.

California residents may request access, deletion, and correction by emailing legal@chartofaccounts.ai. You may designate an authorized agent to make a request on your behalf. We do not charge a fee.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states. Residents have analogous rights under their state privacy laws. We honor those rights using the same process described above.

“Shine the Light” (Cal. Civ. Code § 1798.83). We do not share personal information with third parties for their direct-marketing purposes.

The Service is intended for business use by adults 18 years or older. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact legal@chartofaccounts.ai and we will delete it.

We do not read Do Not Track or Global Privacy Control signals. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing for either signal to opt you out of.

We may update this Privacy Policy from time to time. If we make material changes, we will post the change here at least 30 days before it takes effect, and email account holders where we can. We send that email by hand; we have no mailing list and no scheduled job that sends it for us, so check this page rather than relying on the email arriving. The “Effective” date at the top indicates when this version became effective.

For privacy questions or to exercise your rights, contact:

Arrow CFO LLC
Privacy: legal@chartofaccounts.ai
Support: support@chartofaccounts.ai

See also: Terms of Service, Refund Policy, Subprocessor List, Cookie Policy, Data Processing Addendum, and Acceptable Use Policy.